@x47base/pocketbase-addon 0.1.0

package/security/openapi.json

@@ -0,0 +1,508 @@
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "PocketBase adapter security",
+    "version": "0.1.0"
+  },
+  "servers": [
+    {
+      "url": "/api/security"
+    }
+  ],
+  "security": [
+    {
+      "superuserToken": []
+    }
+  ],
+  "components": {
+    "securitySchemes": {
+      "superuserToken": {
+        "type": "apiKey",
+        "in": "header",
+        "name": "Authorization",
+        "description": "PocketBase superuser token; immediate peer must also belong to configured management networks."
+      }
+    },
+    "schemas": {
+      "Policy": {
+        "type": "object",
+        "required": [
+          "mode",
+          "requestsPerSecond",
+          "burst",
+          "identityPerSecond",
+          "identityBurst",
+          "maxConcurrent",
+          "maxWrites",
+          "maxFiles",
+          "maxRealtime",
+          "maxSubscriptions",
+          "maxSubscriptionsTotal",
+          "maxIdentities"
+        ],
+        "properties": {
+          "mode": {
+            "type": "string",
+            "enum": [
+              "disabled",
+              "observe",
+              "enforce"
+            ]
+          },
+          "requestsPerSecond": {
+            "type": "number",
+            "minimum": 0.001,
+            "maximum": 100000
+          },
+          "burst": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "identityPerSecond": {
+            "type": "number",
+            "minimum": 0.001,
+            "maximum": 100000
+          },
+          "identityBurst": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxConcurrent": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxWrites": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxFiles": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxRealtime": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxSubscriptions": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxSubscriptionsTotal": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "maxIdentities": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50000
+          },
+          "trustedPeers": {
+            "type": "array",
+            "maxItems": 64,
+            "items": {
+              "type": "string",
+              "description": "IPv4 or IPv6 CIDR"
+            }
+          },
+          "managementPeers": {
+            "type": "array",
+            "maxItems": 64,
+            "items": {
+              "type": "string",
+              "description": "IPv4 or IPv6 CIDR"
+            }
+          }
+        }
+      },
+      "Action": {
+        "type": "object",
+        "required": [
+          "family",
+          "reason",
+          "expiresAt"
+        ],
+        "properties": {
+          "family": {
+            "type": "string",
+            "enum": [
+              "auth",
+              "reads",
+              "writes",
+              "files",
+              "realtime",
+              "other"
+            ]
+          },
+          "reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "expiresAt": {
+            "type": "string",
+            "format": "date-time",
+            "description": "Must be within the next 15 minutes"
+          }
+        }
+      }
+    }
+  },
+  "paths": {
+    "/status": {
+      "get": {
+        "summary": "Process counters, bounded traffic history, checkpoint health and unexpired actions",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "mode": {
+                      "type": "string",
+                      "enum": [
+                        "disabled",
+                        "observe",
+                        "enforce"
+                      ]
+                    },
+                    "revision": {
+                      "type": "integer"
+                    },
+                    "observed": {
+                      "type": "integer"
+                    },
+                    "rejected": {
+                      "type": "integer"
+                    },
+                    "storageDegraded": {
+                      "type": "boolean"
+                    },
+                    "checkpointEnabled": {
+                      "type": "boolean"
+                    },
+                    "startedAt": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "lastEvaluated": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "traffic": {
+                      "type": "array",
+                      "maxItems": 60,
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "count": {
+                            "type": "integer"
+                          },
+                          "rejected": {
+                            "type": "integer"
+                          },
+                          "failures": {
+                            "type": "integer"
+                          },
+                          "slow": {
+                            "type": "integer"
+                          }
+                        }
+                      }
+                    },
+                    "actions": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "$ref": "#/components/schemas/Action"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        }
+      }
+    },
+    "/policy/snapshot": {
+      "get": {
+        "summary": "Atomic policy and revision",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "revision": {
+                      "type": "integer"
+                    },
+                    "policy": {
+                      "$ref": "#/components/schemas/Policy"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        }
+      }
+    },
+    "/policy": {
+      "get": {
+        "summary": "Policy with numeric ETag",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Policy"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        }
+      },
+      "put": {
+        "summary": "Replace policy using current numeric If-Match revision",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "revision": {
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          },
+          "409": {
+            "description": "Stale revision; draft must not be silently overwritten"
+          },
+          "400": {
+            "description": "Invalid policy"
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Policy"
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "If-Match",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ]
+      }
+    },
+    "/incidents": {
+      "get": {
+        "summary": "Bounded ascending incident history",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "items": {
+                      "type": "array",
+                      "items": {
+                        "type": "object"
+                      }
+                    },
+                    "nextCursor": {
+                      "type": "integer",
+                      "description": "Zero at end"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        },
+        "parameters": [
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 50
+            }
+          },
+          {
+            "name": "after",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        ]
+      }
+    },
+    "/incidents/{id}/acknowledge": {
+      "post": {
+        "summary": "Idempotent review acknowledgement",
+        "responses": {
+          "204": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer"
+            }
+          }
+        ]
+      }
+    },
+    "/actions": {
+      "post": {
+        "summary": "Set or replace an expiring family block",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Action"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Action"
+              }
+            }
+          }
+        }
+      }
+    },
+    "/actions/{family}": {
+      "delete": {
+        "summary": "Cancel a family block",
+        "responses": {
+          "204": {
+            "description": "Success"
+          },
+          "401": {
+            "description": "Authentication required"
+          },
+          "403": {
+            "description": "Superuser or management network required"
+          }
+        },
+        "parameters": [
+          {
+            "name": "family",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "auth",
+                "reads",
+                "writes",
+                "files",
+                "realtime",
+                "other"
+              ]
+            }
+          }
+        ]
+      }
+    },
+    "/openapi.json": {
+      "get": {
+        "summary": "Public API schema, no instance data",
+        "security": [],
+        "responses": {
+          "200": {
+            "description": "OpenAPI document"
+          }
+        }
+      }
+    }
+  }
+}

package/security/review.go

@@ -0,0 +1,34 @@
+package security
+
+import (
+	"embed"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"io/fs"
+	"strings"
+)
+
+//go:embed ui/*.js ui/*.css
+var dashboardBundle embed.FS
+
+//go:embed openapi.json
+var apiContract []byte
+var dashboardFiles fs.FS = func() fs.FS {
+	f, err := fs.Sub(dashboardBundle, "ui")
+	if err != nil {
+		panic(err)
+	}
+	return f
+}()
+
+func (s *Service) bindReview(r *router.Router[*core.RequestEvent]) {
+	r.BindFunc(func(e *core.RequestEvent) error {
+		path := e.Request.URL.Path
+		if path == "/_/extensions.js" || strings.HasPrefix(path, "/_/extensions/security/") || strings.HasPrefix(path, "/_/extensions/adapter-features/") {
+			e.Response.Header().Set("Cache-Control", "no-store")
+		}
+		return e.Next()
+	})
+	r.GET("/api/security/openapi.json", func(e *core.RequestEvent) error { return e.Blob(200, "application/json", apiContract) })
+	r.GET("/_security/", func(e *core.RequestEvent) error { return e.Redirect(307, "/_/#/security") })
+}